security.yml

name: Security Audit

on:
  pull_request:
    branches: [ "main" ]
  schedule:
    # Run weekly on Monday at 08:00 UTC to catch new advisories
    - cron: '0 8 * * 1'
  workflow_dispatch:

jobs:
  audit:
    name: cargo audit
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4

      - name: Setup Rust
        uses: dtolnay/rust-toolchain@stable
        with:
          toolchain: 1.92.0

      - name: Install cargo-audit
        run: cargo install cargo-audit --locked --version 0.22.0

      - name: Run cargo audit
        # Ignore non-vulnerability warnings for transitive deps we can't control:
        # - RUSTSEC-2025-0134: rustls-pemfile unmaintained (via chdb-rust → reqwest 0.11)
        run: cargo audit --ignore RUSTSEC-2025-0134

  deny:
    name: cargo deny
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4

      - name: Install cargo-deny
        uses: EmbarkStudios/cargo-deny-action@v2
        with:
          command: check
          log-level: warn
          arguments: --all-features